CVE-1999-0407 - By default, IIS 4.0 has a virtual directory /IISADMPWD which contains files that can be used as prox

CVE-1999-0407

Summary

By default, IIS 4.0 has a virtual directory /IISADMPWD which contains files that can be used as proxies for brute force password attacks, or to identify valid users on the system.

References

http://marc.info/?l=bugtraq&m=91983486431506&w=2
http://marc.info/?l=bugtraq&m=92000623021036&w=2

Vulnerable Configurations

cpe:2.3:a:microsoft:internet_information_server:4.0:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:internet_information_server:4.0:*:*:*:*:*:*:*

CVSS

Base:	10.0 (as of 18-10-2016 - 01:59)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
COMPLETE	COMPLETE	COMPLETE

cvss-vector via4

AV:N/AC:L/Au:N/C:C/I:C/A:C

refmap via4

bugtraq	19990209 ALERT: IIS4 allows proxied password attacks over NetBIOS 19990209 Re: IIS4 allows proxied password attacks over NetBIOS
xf	iis-iisadmpwd

Last major update

18-10-2016 - 01:59

Published

09-02-1999 - 05:00

Last modified

18-10-2016 - 01:59